CVE-2026-81899

Concrete CMS versions 9.0.0 through 9.5.2 stored group folder names without sanitizing HTML and rendered them unescaped on the Members > Groups dashboard page, enabling stored cross-site scripting (CWE-79). An authenticated attacker holding the Add Group Folder permission can save a script payload as a folder name; the group search grid returns it without output encoding, so the markup executes in the browser session of any administrator who views the Groups dashboard. Successful exploitation allows session and token theft and any action available in the administrator's context, giving effectively full site compromise. The flaw requires an authenticated, moderately privileged attacker and an admin to view the poisoned page, reflected in the Concrete CMS team's CVSS v4.0 score of 7.3 (high). No public proof of concept is known and the vulnerability is not listed in CISA's KEV catalog, so exploitation in the wild appears unlikely at this time.

What to do: Upgrade Concrete CMS to the latest 9.x release newer than 9.5.2, where the folder-name handling and output encoding are fixed. Audit existing group folder names in the Members > Groups area for embedded HTML or script payloads and review administrator session logs for anomalous activity. Restrict the Add Group Folder permission to trusted editors only, since a lower-privileged user with that permission can weaponize a folder name against administrators.